Overview

overview

10

Static

static

3

8d3d306f84...cs.exe

windows7-x64

10

8d3d306f84...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 05:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8d3d306f847c77bf06101d746a052670_NeikiAnalytics.exe

  • Size

    381KB

  • MD5

    8d3d306f847c77bf06101d746a052670

  • SHA1

    ddddf635465a50911cca99be92b455914615afd8

  • SHA256

    aa5b49e9ac09f3c9daa610609589c8c1303851bf4fe09bf4577591cc267e186d

  • SHA512

    aa4f3cb1300137af0f4fefe34f36e07e6b057b6110caef4c139a19059340e0061660a5f885ad3b720214efd74267f27126a325a3072c4b9543620c0fa936dc47

  • SSDEEP

    6144:+BJk9av85lgrciUnEOqGRPW8ETxPLsYp:+XkEvEgrciUEOq0PEVL9p

Score
10/10
redlinezgratinfostealerrat

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 35 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d3d306f847c77bf06101d746a052670_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8d3d306f847c77bf06101d746a052670_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3912-3-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

    Download

  • memory/3912-2-0x0000000002D40000-0x0000000002D86000-memory.dmp

    Filesize

    280KB

    Download

  • memory/3912-1-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3912-4-0x0000000004AD0000-0x0000000004B0C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3912-5-0x0000000007500000-0x0000000007AA4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3912-6-0x0000000004E50000-0x0000000004E8A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3912-7-0x0000000000400000-0x0000000002BC9000-memory.dmp

    Filesize

    39.8MB

    Download

  • memory/3912-13-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-71-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-69-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-65-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-63-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-61-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-59-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-57-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-55-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-53-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-51-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-49-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-47-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-45-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-41-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-39-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-38-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-33-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-31-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-30-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-27-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-25-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-23-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-21-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-19-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-17-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-11-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-9-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-8-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-67-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-43-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-35-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-15-0x0000000004E50000-0x0000000004E85000-memory.dmp

    Filesize

    212KB

    Download

  • memory/3912-800-0x0000000009E30000-0x000000000A448000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3912-801-0x000000000A450000-0x000000000A462000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3912-802-0x000000000A470000-0x000000000A57A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3912-803-0x000000000A5A0000-0x000000000A5DC000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3912-804-0x0000000004B60000-0x0000000004BAC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3912-808-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

    Download

  • memory/3912-807-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

    Filesize

    1024KB

    Download